Privacy Policy

1. Introduction

Hubbio ("we") is a social media manager for Indonesian small businesses: it schedules and publishes posts to Instagram, Threads, Facebook, TikTok, X and YouTube, answers incoming messages, tracks analytics, and helps create content with AI. This Privacy Policy explains what data we process, why, who receives it, how long we keep it, and your rights over it.

Hubbio is operated by an individual owner. The owner is the controller of personal data; contact: [email protected].

2. Data we process

We only process data needed to run the service:

• Account: name, email address, password (stored as a hash, never in plain form), preferred language, and basic profile data if you sign in with Google.
• Workspaces and members: workspace name, the list of members and their roles (owner, admin, editor, viewer), and invitations.
• Social accounts you connect: account identity (username, ID) and OAuth access tokens, which we store encrypted. You can disconnect an account at any time in settings.
• Content: post text, schedules, drafts, publishing history, and photos/videos you upload to Hubbio.
• Incoming messages: direct messages (DMs) and comments from accounts you connect, plus the status, labels and notes you add in the inbox.
• Analytics: post and account metrics from the platforms (for example reach, followers and aggregated audience data), and click counts on Hubbio short links; clicker IP addresses are stored only as a hash.
• AI features: prompts, the business context you provide, and generated results, including your AI credit usage history.
• Payments: plan, amount, status and transaction records. We do not store card numbers or payer bank account data; the payment provider handles that.
• Referral and withdrawals: invite code, Hubbio balance history, and, if you withdraw, the destination account details you provide.
• Support: messages and replies on tickets you send to [email protected] or through the app.
• Technical and security data: IP address, device and browser type, login sessions, and security logs (for example sign-in attempts and password changes).
• Consent: the version of the Terms and Privacy Policy you accepted and when, and your analytics cookie choice.

3. What we use data for

Our legal bases are your consent (for example analytics cookies and acceptance of these terms), performance of the service agreement, our legitimate interest in securing the service, and legal obligations.

• Providing the service you request: publishing and scheduling posts, showing the inbox and analytics, generating AI content.
• Managing accounts, workspaces, plans, trials, payments, referrals and support.
• Sending transactional email (verification, plan expiry reminders, scheduled reports, workspace lock warnings). We do not send third-party advertising.
• Keeping the service secure, preventing abuse and fraud, and meeting legal obligations.
• Measuring visits to public pages, only if you accept analytics cookies.

4. AI features

When you use AI features (captions, images, text enhancement, analytics summaries, assistant), the prompt and the context it needs are sent to an AI model provider. We use OpenRouter as an intermediary and, depending on service configuration, other model providers such as OpenAI, Google, or Anthropic. This processing may take place outside Indonesia.

We do not send social account access tokens to AI providers, and we do not sell your data to train models. Each provider has its own retention and training policy, which is outside our control and may change; check the provider policies if this matters to you. Do not enter sensitive personal data into AI prompts.

5. Instagram messaging data

If you connect an Instagram business account and grant messaging permission, Hubbio processes the direct messages (DMs) that reach that account. In this case Hubbio acts as a processor on behalf of your business (the controller is the business that owns the Instagram account); we process the data only on your instructions, namely to run the inbox.

• What is stored: the message text and attachments, the sender's Instagram-scoped ID, username, name and profile picture, message times, and the status, labels and notes your team adds.
• Purpose: to show messages in the Hubbio inbox and reply on behalf of your business. Nothing else.
• Never sold, never shared with others, and never used to train AI. Message content is never sent to any AI model, and there are no automated or AI-generated replies: every reply is typed or selected and sent by a person on your team.
• Who can read it: workspace members with the editor role or higher. Hubbio operators do not read messages unless you ask us to for support.
• Retention: while that Instagram account stays connected. After you disconnect the account or revoke permission (deauthorization), all its messages are deleted within 30 days. Messages unsent by their sender have their text erased from Hubbio.
• Raw notification log (webhooks): for reliability, a raw copy of the notifications we receive from Meta, which includes message content, is kept temporarily and deleted 14 days after processing finishes. Notifications that fail to process are kept so they can be fixed, until they are processed.
• How to delete: (1) disconnect the account under Social accounts; (2) remove Hubbio in your Instagram/Facebook settings, which triggers an automatic data deletion request (Meta data deletion callback); or (3) email [email protected]. Full steps are on the Data deletion page.
• People who sent a message and want their data deleted can contact the business that owns the account, or write to [email protected].

6. YouTube data

If you connect a YouTube channel, Hubbio uses YouTube API Services. By using YouTube features in Hubbio you are bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Google processes data under the Google Privacy Policy (https://policies.google.com/privacy).

Hubbio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• Data accessed: the channel's ID, name, handle and picture; the channel's video list with titles, status and statistics from YouTube; comments on the channel's videos (text, author channel name and picture, time); YouTube Analytics reports; and the videos, titles, descriptions, tags and thumbnails you upload through Hubbio.
• Purpose: uploading and deleting videos when you ask, showing the video list and comments so they can be replied to, hidden or deleted, and showing channel analytics. Nothing else. YouTube data is never sold, never used for advertising, never used to train AI, and never combined across channels.
• Who can see it: members of the workspace where the channel is connected, as approved by the person who granted access when connecting. If that person leaves the workspace, the YouTube account is paused and deleted unless it is reconnected within 7 days.
• AI: comment text is sent to the AI model provider only when you press "Reply with AI", to draft a reply that you review before sending.
• Retention: comments 30 days; statistics and analytics while the channel stays connected, at most 25 months; the video list is cached for at most 10 minutes.
• Deletion: disconnecting the channel under Social accounts, pressing "Delete YouTube data stored by Hubbio" on the account card, or deleting your account/workspace removes YouTube data from Hubbio immediately, within 7 days at most. If you revoke access in Google, the data is deleted within 30 days. Copies in backups expire within 30 days. Deleting data in Hubbio does not delete anything on YouTube.
• How to revoke access: open https://security.google.com/settings/security/permissions and remove Hubbio.
• Questions about YouTube data: contact us through the Contact section below.

7. TikTok data

When you connect a TikTok account, Hubbio uses TikTok's official APIs (TikTok for Developers and TikTok API for Business). You sign in directly on TikTok and choose which permissions to grant; Hubbio never sees your TikTok password. TikTok processes data under the TikTok Privacy Policy (https://www.tiktok.com/legal/privacy-policy).

• Data accessed: account ID, display name, username, and profile photo; follower, following, like, and video counts; your video list with its statistics (views, likes, comments, shares); and the videos, photos, captions, and post settings you publish through Hubbio.
• When TikTok comment and insight features are available in Hubbio: comments on your own videos (text, commenter name and photo, time), the reply or hide actions you take on comments, and account and video insights (for example reach, watch time, and aggregated audience data).
• Purpose: publishing and scheduling posts at your request, showing comments so you can reply to or hide them, and showing account analytics. Nothing else. TikTok data is not sold, not used for advertising, and not used to train AI.
• Who can see it: members of the workspace where the TikTok account is connected.
• TikTok access and refresh tokens are stored encrypted so scheduled posts can still publish when you are not using Hubbio.
• Retention: statistics and analytics while the account stays connected, for at most 25 months; comments for at most 30 days. When you disconnect a TikTok account from Hubbio, we revoke its permissions on TikTok. To delete TikTok data stored by Hubbio, follow the Data Deletion page or email [email protected].
• How to revoke access: in the TikTok app open Settings and privacy > Security > Manage app permissions, select Hubbio, then Remove access; or disconnect the TikTok account under Social accounts in Hubbio.

8. Who receives data

We share data only with parties needed to run the service. We do not sell your personal data.

9. Transfers outside Indonesia

Some parties above process data outside Indonesia. We choose providers with adequate data protection and send only the data required. By using the related features (for example AI or connecting social platforms), you understand that data may be processed outside Indonesia.

10. How long we keep data

Account and workspace data is kept while your account is active. The following retention periods apply to media and certain data:

11. Backups

We make automatic database backups: hourly backups are kept for 14 days and daily backups for 30 days. Data you have deleted from active systems may remain in backups for up to 30 days before it is gone completely. Backups are not used for any other purpose.

12. Trial and plans

Hubbio has no free plan. Each user can try the PRO plan for 7 days without a card (once per user). A workspace without an active plan is locked: scheduled posts are held and media is deleted 30 days later. We send reminder emails before the plan expires and before media is deleted. Details are in the Terms.

13. Referrals and balance

If you sign up through an invite link, the inviter can see that the signup came from their code and that your first payment produced a commission, without seeing your other account or payment data. Hubbio balance is recorded in a per-user ledger. Withdrawing balance (minimum Rp50,000) requires the destination account details you provide.

14. Cookies and browser storage

Analytics cookies (Google Analytics and Meta Pixel) are loaded only after you consent, only on public pages (home, pricing, about, blog, sign-in, sign-up and legal pages), and never inside the app. We do not use advertising cookies: advertising storage permissions are always denied. You can change your choice at any time.

15. Your rights

Under Indonesia's Personal Data Protection Law, you have the right to:

• access and obtain a copy of your data. Use "Download my data" in Settings > Account; we email you a download link (valid for 24 hours).
• correct inaccurate data in Settings or by email.
• delete your account and data from Settings > Account > Delete account, or via the Data deletion page, which has the details.
• withdraw consent (for example analytics cookies, via "Cookie preferences") and object to certain processing.
• move your data (portability) through the export above.
• lodge a complaint with the competent personal data protection authority.

16. Security and breach notification

We protect your data with encrypted social tokens, hashed passwords, role-based access inside workspaces, and encrypted connections. No system is entirely risk-free.

If a personal data protection failure affects you, we will notify you and the competent authority in writing within 3 x 24 hours of becoming aware of it, as the law requires.

17. Minors

Minors should use Hubbio with the consent and supervision of a parent or guardian. If you are a parent or guardian and know your child is using Hubbio without your consent, contact [email protected] and we will help delete the account.

18. Changes to this policy

We may update this policy. For material changes we notify you by email or in-app notice and ask for your consent again. The latest date and version are at the top of this page.

19. Contact

Questions, or requests for access, correction or deletion of data: [email protected].